SB2024022748 - SUSE update for SUSE Manager Server 4.2

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Use of Password Hash Instead of Password for Authentication (CVE-ID: CVE-2022-46146)

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to incorrect implementation of basic authentication. A remote attacker with knowledge of the password hash can authenticate against Prometheus without actual knowledge of the password.

2) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2023-22644)

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to software stores sensitive information into log files. A local user can read the log files and gain access to sensitive data.

Remediation

Install update from vendor's website.

References

• https://www.suse.com/support/update/announcement/2023/suse-su-20232594-1/